Dynamic NAT and IPSEC

[pavlosd]

Hi all,

We are currently implementing some IPSEC tunnels with a couple of customers. Our requirement is to use public IP addresses for the clients.

Some of our customers own an ADSL line with static Public IP address. Is it possible to setup a tunnel and they use the same public IP for both dynamic nating the inside clients and for ipsec termination (I remind you that we do not wish to use private IPs or customers internal network).

Regards.

[aacole]

Yes this is possible. The outside address can be used as a PAT source address, and also be used to act as the IPSec peer.

If the VPN is setup on either a PIX or a router then the traffic that is to go over the tunnel is excluded from the NAT process. The outside address would have to be a public address.

[pavlosd]

What if I do not wish to exclude them from NAT? We want to have one public address, both for traffic and IPSEC Peering... is that possible?